Buggy code:
StringManager sm = StringManager . getManager ( "org.apache.tomcat.resources" , locale ) ; DateFormat dateFormat = new SimpleDateFormat ( DirHandler . datePattern , locale ) ; boolean inInclude = ( req . getChild ( ) ) != null ; Request subReq = req ; if ( inInclude ) subReq = req . getChild ( ) ; Context ctx = req . getContext ( ) ; <START_BUG> String pathInfo = subReq . getPathInfo ( ) ; <END_BUG> if ( pathInfo == null ) pathInfo = "" ; String absPath = ctx . getRealPath ( pathInfo ) ; File file = new File ( absPath ) ; String requestURI = subReq . getRequestURI ( ) ; String base = ctx . getAbsolutePath ( ) ; if ( ( absPath . length ( ) ) > ( base . length ( ) ) ) { String relPath = absPath . substring ( ( ( base . length ( ) ) + 1 ) ) ; String relPathU = relPath . toUpperCase ( ) ; if ( ( relPathU . startsWith ( "WEB-INF" ) ) || ( relPathU . startsWith ( "META-INF" ) ) ) { context . getContextManager ( ) . handleStatus ( req , res , 404 ) ; return ; } } if ( ( sbNote ) == 0 ) { sbNote = req . getContextManager ( ) . getNoteId ( REQUEST_NOTE , "RedirectHandler.buff" ) ; } StringBuffer buf = ( ( StringBuffer ) ( req . getNote ( sbNote ) ) ) ; if ( buf == null ) { buf = new StringBuffer ( ) ; req . setNote ( sbNote , buf ) ; } if ( ! inInclude ) { res . setContentType ( "text//html" ) ; buf . append ( "<html>\r\n" ) ; buf . append ( "<head>\r\n" ) ; buf . append ( "<title>" ) . append ( sm . getString ( "defaultservlet.directorylistingfor" ) ) . append ( requestURI ) ; buf . append ( "<//title>\r\n<//head><body<seq2seq4repair_space>bgcolor=white>\r\n" ) ; } buf . append ( "<table<seq2seq4repair_space>width=90%<seq2seq4repair_space>cellspacing=0<seq2seq4repair_space>" ) ; buf . append ( "cellpadding=5<seq2seq4repair_space>align=center>" ) ; buf . append ( "<tr><td<seq2seq4repair_space>colspan=3><font<seq2seq4repair_space>size=+2><strong>" ) ; buf . append ( sm . getString ( "defaultservlet.directorylistingfor" ) ) . append ( requestURI ) ; buf . append ( "<//strong><//td><//tr>\r\n" ) ; if ( ! ( pathInfo . equals ( "//" ) ) ) { buf . append ( "<tr><td<seq2seq4repair_space>colspan=3<seq2seq4repair_space>bgcolor=#ffffff>" ) ; String toPath = requestURI ; if ( toPath . endsWith ( "//" ) ) { toPath = toPath . substring ( 0 , ( ( toPath . length ( ) ) - 1 ) ) ; } toPath = toPath . substring ( 0 , toPath . lastIndexOf ( "//" ) ) ; if ( ( toPath . length ( ) ) == 0 ) { toPath = "//" ; } buf . append ( ( ( ( ( "<a<seq2seq4repair_space>href=\"" + toPath ) + "\"><tt>" ) + ( sm . getString ( "defaultservlet.upto" ) ) ) + toPath ) ) ; buf . append ( "<//tt><//a><//td><//tr>\r\n" ) ; } String slashedRequestURI = null ; if ( requestURI . endsWith ( "//" ) ) { slashedRequestURI = requestURI ; } else { slashedRequestURI = requestURI + "//" ; } String [ ] fileNames = file . list ( ) ; boolean dirsHead = true ; boolean shaderow = false ; for ( int i = 0 ; i < ( fileNames . length ) ; i ++ ) { String fileName = fileNames [ i ] ; if ( ( ( ( ( pathInfo . length ( ) ) == 0 ) || ( "//" . equals ( pathInfo ) ) ) && ( "WEB-INF" . equalsIgnoreCase ( fileName ) ) ) || ( "META-INF" . equalsIgnoreCase ( fileName ) ) ) continue ; File f = new File ( file , fileName ) ; if ( f . isDirectory ( ) ) { if ( dirsHead ) { dirsHead = false ; buf . append ( "<tr><td<seq2seq4repair_space>colspan=3<seq2seq4repair_space>bgcolor=#cccccc>" ) ; buf . append ( "<font<seq2seq4repair_space>size=+2><strong>" ) . append ( sm . getString ( "defaultservlet.subdirectories" ) ) . append ( "<//strong>\r\n" ) ; buf . append ( "<//font><//td><//tr>\r\n" ) ; } String fileN = f . getName ( ) ; buf . append ( "<tr" ) ; if ( shaderow ) buf . append ( "<seq2seq4repair_space>bgcolor=#eeeeee" ) ; shaderow = ! shaderow ; buf . append ( "><td>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;" ) ; buf . append ( "<tt><a<seq2seq4repair_space>href=\"" ) . append ( slashedRequestURI ) . append ( fileN ) . append ( "\">" ) . append ( fileN ) . append ( "//<//a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;" ) . append ( "<//tt>\r\n" ) ; buf . append ( "<//td><td><tt>&nbsp;&nbsp;<//tt><//td>" ) ; buf . append ( "<td<seq2seq4repair_space>align=right><tt>" ) ; buf . append ( dateFormat . format ( new Date ( f . lastModified ( ) ) ) ) ; buf . append ( "<//tt><//td><//tr>\r\n" ) ; } } shaderow = false ; buf . append ( "<tr><td<seq2seq4repair_space>colspan=3<seq2seq4repair_space>bgcolor=#ffffff>&nbsp;<//td><//tr>" ) ; boolean fileHead = true ; for ( int i = 0 ; i < ( fileNames . length ) ; i ++ ) { File f = new File ( file , fileNames [ i ] ) ; if ( f . isFile ( ) ) { String fileN = f . getName ( ) ; if ( fileHead ) { fileHead = false ; buf . append ( "<tr><td<seq2seq4repair_space>colspan=4<seq2seq4repair_space>bgcolor=#cccccc>" ) ; buf . append ( "<font<seq2seq4repair_space>size=+2><strong>" ) . append ( sm . getString ( "defaultservlet.files" ) ) . append ( "<//strong><//font><//td><//tr>" ) ; } buf . append ( "<tr" ) ; if ( shaderow ) buf . append ( "<seq2seq4repair_space>bgcolor=#eeeeee" ) ; shaderow = ! shaderow ; buf . append ( "><td>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r\n" ) ; buf . append ( "<tt><a<seq2seq4repair_space>href=\"" ) . append ( slashedRequestURI ) . append ( fileN ) . append ( "\">" ) . append ( fileN ) . append ( "<//a>" ) ; buf . append ( "&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<//tt>" ) ; buf . append ( "<//td>\r\n" ) ; buf . append ( "<td<seq2seq4repair_space>align=right><tt>" ) ; displaySize ( buf , ( ( int ) ( f . length ( ) ) ) ) ; buf . append ( "<//tt><//td>" ) ; buf . append ( "<td<seq2seq4repair_space>align=right><tt>" ) ; buf . append ( dateFormat . format ( new Date ( f . lastModified ( ) ) ) ) ; buf . append ( "<//tt><//td><//tr>\r\n" ) ; } buf . append ( "\r\n" ) ; } buf . append ( "<tr><td<seq2seq4repair_space>colspan=3<seq2seq4repair_space>bgcolor=#ffffff>&nbsp;<//td><//tr>"

Fix:
String pathInfo = subReq . getServletPath ( ) ;